Since the main goal of the common corruption benchmark [1]} is to show the model’s behavior on unseen corruptions, we do not use overlapping augmentations in training (see App. ).
The only exception is Gaussian augmentation which we mark in gray in Table REF  following [2]} since it belongs to common corruptions.
We note that removing only Gaussian noise from evaluation is not sufficient, because other noises can be affected as well by training with Gaussian augmentation.
Thus, the results of 100% and 50% Gaussian augmentation are shown only for illustrative purposes suggesting that adversarial training with no prior knowledge about the corruptions can obtain almost the same results as direct augmentation.
<TABLE>